url-sanitizer 0.2.2 → 0.3.0

package/README.md

@@ -17,7 +17,7 @@ For browsers and web sites, standalone ESM builds are available in `dist/` direc
 * node_modules/url-sanitizer/dist/url-sanitizer.js
 * node_modules/url-sanitizer/dist/url-sanitizer.min.js
 
-Or, download the source code from [Releases](https://github.com/asamuzaK/urlSanitizer/releases).
+Or, download them from [Releases](https://github.com/asamuzaK/urlSanitizer/releases).
 
 ## Usage
 
@@ -30,13 +30,15 @@ import urlSanitizer, {
 ## sanitizeURL(url, opt)
 
 Sanitize the given URL.
-* `data` and/or `file` schemes must be explicitly allowed.
-* `javascript` and/or `vbscript` schemes can not be allowed.
+* `data` and `file` schemes must be explicitly allowed.
+* `javascript` and `vbscript` schemes can not be allowed.
 
 ### Parameters
 
 * `url` **[string][1]** URL input
-* `opt` **[object][4]** options
+* `opt` **[object][3]** options
+* `opt.allow` **[Array][4]<[string][1]>** array of allowed schemes
+* `opt.deny` **[Array][4]<[string][1]>** array of denied schemes
 
 Returns **[Promise][5]<[string][1]?>** sanitized URL, `null`able
 
@@ -56,21 +58,6 @@ const res3 = await sanitizeURL(`data:text/html;base64,${base64data3}`, {
   allow: ['data']
 }).then(res => decodeURIComponent(res));
 // -> 'data:text/html,&lt;script&gt;alert(1);&lt;/script&gt;'
-
-// Also an option if you don't want to escape tags and quotes in data URL
-// But use it with care
-const res4 = await sanitizeURL('data:image/svg+xml,%3Csvg%3E%3C/svg%3E', {
-  allow: ['data'],
-  escapeTags: false
-}).then(res => decodeURIComponent(res));
-// -> 'data:image/svg+xml,<svg></svg>'
-
-const res5 = await sanitizeURL('data:text/html,%3Cscript%3Ealert(1);%3C/script%3E', {
-  allow: ['data'],
-  escapeTags: false
-}).then(res => decodeURIComponent(res));
-// WATCH OUT!!!
-// -> 'data:text/html,<script>alert(1);</script>'
 ```
 
 ## sanitizeURLSync
@@ -85,8 +72,8 @@ Determines whether the given URI is valid.
 
 * `uri` **[string][1]** URI input
 
-Returns **[Promise][5]<[boolean][3]>** result
-* Always `true` for `web+*` and/or `ext+*` schemes
+Returns **[Promise][5]<[boolean][2]>** result
+* Always `true` for `web+*` and `ext+*` schemes
 
 ```javascript
 const res1 = await isURI('https://example.com/foo');
@@ -114,7 +101,7 @@ Get an array of URI schemes registered at [iana.org](https://www.iana.org/assign
 * Historical schemes omitted.
 * `moz-extension` scheme added.
 
-Returns **[Array][2]<[string][1]>** array of registered URI schemes
+Returns **[Array][4]<[string][1]>** array of registered URI schemes
 
 ```javascript
 const schemes = urlSanitizer.get();
@@ -129,7 +116,7 @@ Check if the given scheme is registered.
 
 * `scheme` **[string][1]** scheme
 
-Returns **[boolean][3]** result
+Returns **[boolean][2]** result
 
 ```javascript
 const res1 = urlSanitizer.has('https');
@@ -142,17 +129,23 @@ const res2 = urlSanitizer.has('foo');
 ### urlSanitizer.add(scheme)
 
 Add a scheme to the list of URI schemes.
-* `javascript` and/or `vbscript` schemes can not be registered. It throws.
+* `javascript` and `vbscript` schemes can not be registered. It throws.
 
 #### Parameters
 
 * `scheme` **[string][1]** scheme
 
-Returns **[Array][2]<[string][1]>** array of registered URI schemes
+Returns **[Array][4]<[string][1]>** array of registered URI schemes
 
 ```javascript
+console.log(isURISync('foo'));
+// -> false;
+
 const res = urlSanitizer.add('foo');
 // -> ['aaa', 'aaas', 'about', 'acap', 'acct', 'acd', ... 'foo', ...];
+
+console.log(isURISync('foo'));
+// -> true;
 ```
 
 ### urlSanitizer.remove(scheme)
@@ -163,23 +156,29 @@ Remove a scheme from the list of URI schemes.
 
 * `scheme` **[string][1]** scheme
 
-Returns **[boolean][3]** result
+Returns **[boolean][2]** result
 * `true` if the scheme is successfully removed, `false` otherwise.
 
 ```javascript
+console.log(isURISync('aaa'));
+// -> true;
+
 const res1 = urlSanitizer.remove('aaa');
 // -> true
 
+console.log(isURISync('aaa'));
+// -> false;
+
 const res2 = urlSanitizer.remove('foo');
 // -> false
 ```
 
 [1]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/String
 
-[2]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Array
+[2]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Boolean
 
-[3]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Boolean
+[3]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object
 
-[4]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object
+[4]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Array
 
 [5]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise

package/dist/url-sanitizer.js

@@ -4,6 +4,241 @@ var TYPE_TO = -1;
 var getType = (o) => Object.prototype.toString.call(o).slice(TYPE_FROM, TYPE_TO);
 var isString = (o) => typeof o === "string" || o instanceof String;
 
+// src/lib/file/text-chars.json
+var text_chars_default = [
+  7,
+  8,
+  9,
+  10,
+  11,
+  12,
+  13,
+  27,
+  32,
+  33,
+  34,
+  35,
+  36,
+  37,
+  38,
+  39,
+  40,
+  41,
+  42,
+  43,
+  44,
+  45,
+  46,
+  47,
+  48,
+  49,
+  50,
+  51,
+  52,
+  53,
+  54,
+  55,
+  56,
+  57,
+  58,
+  59,
+  60,
+  61,
+  62,
+  63,
+  64,
+  65,
+  66,
+  67,
+  68,
+  69,
+  70,
+  71,
+  72,
+  73,
+  74,
+  75,
+  76,
+  77,
+  78,
+  79,
+  80,
+  81,
+  82,
+  83,
+  84,
+  85,
+  86,
+  87,
+  88,
+  89,
+  90,
+  91,
+  92,
+  93,
+  94,
+  95,
+  96,
+  97,
+  98,
+  99,
+  100,
+  101,
+  102,
+  103,
+  104,
+  105,
+  106,
+  107,
+  108,
+  109,
+  110,
+  111,
+  112,
+  113,
+  114,
+  115,
+  116,
+  117,
+  118,
+  119,
+  120,
+  121,
+  122,
+  123,
+  124,
+  125,
+  126,
+  128,
+  129,
+  130,
+  131,
+  132,
+  133,
+  134,
+  135,
+  136,
+  137,
+  138,
+  139,
+  140,
+  141,
+  142,
+  143,
+  144,
+  145,
+  146,
+  147,
+  148,
+  149,
+  150,
+  151,
+  152,
+  153,
+  154,
+  155,
+  156,
+  157,
+  158,
+  159,
+  160,
+  161,
+  162,
+  163,
+  164,
+  165,
+  166,
+  167,
+  168,
+  169,
+  170,
+  171,
+  172,
+  173,
+  174,
+  175,
+  176,
+  177,
+  178,
+  179,
+  180,
+  181,
+  182,
+  183,
+  184,
+  185,
+  186,
+  187,
+  188,
+  189,
+  190,
+  191,
+  192,
+  193,
+  194,
+  195,
+  196,
+  197,
+  198,
+  199,
+  200,
+  201,
+  202,
+  203,
+  204,
+  205,
+  206,
+  207,
+  208,
+  209,
+  210,
+  211,
+  212,
+  213,
+  214,
+  215,
+  216,
+  217,
+  218,
+  219,
+  220,
+  221,
+  222,
+  223,
+  224,
+  225,
+  226,
+  227,
+  228,
+  229,
+  230,
+  231,
+  232,
+  233,
+  234,
+  235,
+  236,
+  237,
+  238,
+  239,
+  240,
+  241,
+  242,
+  243,
+  244,
+  245,
+  246,
+  247,
+  248,
+  249,
+  250,
+  251,
+  252,
+  253,
+  254,
+  255
+];
+
 // src/lib/iana/uri-schemes.json
 var uri_schemes_default = [
   "aaa",
@@ -399,13 +634,7 @@ var parseBase64 = (data) => {
   }
   const bin = atob(data);
   const uint8arr = Uint8Array.from([...bin].map((c) => c.charCodeAt(0)));
-  const textChars = /* @__PURE__ */ new Set([7, 8, 9, 10, 11, 12, 13, 27]);
-  for (let i = 32; i < 127; i++) {
-    textChars.add(i);
-  }
-  for (let i = 128; i <= 255; i++) {
-    textChars.add(i);
-  }
+  const textChars = new Set(text_chars_default);
   let parsedData;
   if (uint8arr.every((c) => textChars.has(c))) {
     parsedData = bin.replace(/\s/g, getUrlEncodedString);
@@ -490,6 +719,15 @@ var URISchemes = class {
   }
 };
 var URLSanitizer = class extends URISchemes {
+  /* private fields */
+  #recurse;
+  /**
+   * construct
+   */
+  constructor() {
+    super();
+    this.#recurse = /* @__PURE__ */ new Map();
+  }
   /**
    * sanitize URL
    * NOTE: `data` and/or `file` schemes must be explicitly allowed
@@ -499,13 +737,12 @@ var URLSanitizer = class extends URISchemes {
    * @param {object} opt - options
    * @param {Array.<string>} opt.allow - array of allowed schemes
    * @param {Array.<string>} opt.deny - array of denied schemes
-   * @param {boolean} opt.escapeTags - escape tags and quotes in data URL
    * @returns {?string} - sanitized URL
    */
-  sanitize(url, opt = { allow: [], deny: [], escapeTags: true }) {
+  sanitize(url, opt = { allow: [], deny: [] }) {
     let sanitizedUrl;
     if (super.isURI(url)) {
-      const { allow, deny, escapeTags } = opt ?? {};
+      const { allow, deny } = opt ?? {};
       const { href, pathname, protocol } = new URL(url);
       const scheme = protocol.replace(/:$/, "");
       const schemeParts = scheme.split("+");
@@ -555,66 +792,57 @@ var URLSanitizer = class extends URISchemes {
           if (isBase64) {
             let parsedData = parseBase64(data);
             if (parsedData !== data) {
-              const regDataUrl = /data:[^,]*;?base64,[\dA-Za-z+/\-_=]+/g;
-              if (regDataUrl.test(parsedData)) {
-                const dataUrlArr = [];
-                let arr = regDataUrl.exec(parsedData);
-                do {
-                  if (arr) {
-                    dataUrlArr.push(arr);
-                  }
-                } while (arr = regDataUrl.exec(parsedData));
-                if (dataUrlArr.length) {
-                  for (const i of dataUrlArr) {
-                    const [dataUrl] = i;
+              if (/data:[^,]*,/.test(parsedData)) {
+                const regDataUrl = /data:[^,]*,[^"]+/g;
+                const regBase64DataUrl = /data:[^,]*;?base64,[\dA-Za-z+/\-_=]+/;
+                const matchedDataUrls = parsedData.matchAll(regDataUrl);
+                const items = [...matchedDataUrls].reverse();
+                if (items.length) {
+                  for (const item of items) {
+                    const { index } = item;
+                    let [dataUrl] = item;
+                    if (regBase64DataUrl.test(dataUrl)) {
+                      [dataUrl] = regBase64DataUrl.exec(dataUrl);
+                    }
+                    const [beforeDataUrl, afterDataUrl] = [
+                      parsedData.substring(0, index),
+                      parsedData.substring(index + dataUrl.length)
+                    ];
+                    this.#recurse.set(dataUrl, dataUrl);
                     const parsedDataUrl = this.sanitize(dataUrl, {
                       allow: ["data"]
                     });
                     if (parsedDataUrl) {
-                      parsedData = parsedData.replace(dataUrl, parsedDataUrl);
+                      parsedData = [
+                        beforeDataUrl,
+                        parsedDataUrl,
+                        afterDataUrl
+                      ].join("");
                     }
-                    type = 0;
                   }
                 }
-              } else if (/data:[^,]*,/.test(parsedData) && !(escapeTags ?? true)) {
-                const dataArr = parsedData.split(/data:[^,]*,/);
-                const l = dataArr.length;
-                let i = 1;
-                while (i < l) {
-                  const dataItem = dataArr[i].replace(regEncodedChars, escapeUrlEncodedHtmlChars);
-                  parsedData = parsedData.replace(dataArr[i], dataItem);
-                  i++;
-                }
-                type = 0;
               }
-              urlToSanitize = `${scheme}:${mediaType.join(";")},${parsedData}`;
-              if (escapeTags ?? true) {
+              if (this.#recurse.has(url)) {
+                this.#recurse.delete(url);
+              } else {
                 type = 1;
-              } else if (!Number.isInteger(type)) {
-                type = 2;
               }
-            } else if (escapeTags ?? true) {
-              type = 1;
+              urlToSanitize = `${scheme}:${mediaType.join(";")},${parsedData}`;
             } else {
-              type = 2;
+              type = 1;
             }
-          } else if (escapeTags ?? true) {
-            type = 1;
+          } else if (this.#recurse.has(url)) {
+            this.#recurse.delete(url);
           } else {
-            type = 2;
+            type = 1;
           }
         } else {
           type = 1;
         }
-        switch (type) {
-          case 1:
-            sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString).replace(regAmp, escapeUrlEncodedHtmlChars).replace(regEncodedChars, escapeUrlEncodedHtmlChars);
-            break;
-          case 2:
-            sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString).replace(regAmp, escapeUrlEncodedHtmlChars);
-            break;
-          default:
-            sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString);
+        if (type === 1) {
+          sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString).replace(regAmp, escapeUrlEncodedHtmlChars).replace(regEncodedChars, escapeUrlEncodedHtmlChars);
+        } else {
+          sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString).replace(regAmp, escapeUrlEncodedHtmlChars);
         }
       }
     }
@@ -629,8 +857,7 @@ var isURI = async (uri) => {
 };
 var sanitizeUrl = (url, opt) => urlSanitizer.sanitize(url, opt ?? {
   allow: [],
-  deny: [],
-  escapeTags: true
+  deny: []
 });
 var sanitizeURL = async (url, opt) => {
   const res = await sanitizeUrl(url, opt);